HonahX opened a new pull request, #4459:
URL: https://github.com/apache/polaris/pull/4459
`PolarisEventMetadataFactory.create()` calls
`getDeferredIdentity().subscribeAsCompletionStage().getNow(null)` to resolve
the current user for event metadata. When called before authentication has
completed
(e.g., in pre-authentication filters), this can trigger the auth pipeline,
which may fail with `CompletionException` wrapping an
`AuthenticationFailedException`.
Previously, this exception would propagate to the caller. For example,
when the rate limiter filter emits an event before rejecting a request, the
leaked
Completion exception gets mapped to 500 instead of the intended 429.
In general, since `user` itself is an optional field, proceed the event
dispatching with a null user instead of failing directly could increase the
stability and while we can still see/notice the actual error through debug log.
## Changes
- `PolarisEventMetadataFactory.java`: Refactor `getUser()` to use new
`getSecurityIdentity()` helper with `CompletionException` handling and debug
logging
- `PolarisEventMetadataFactoryTest.java`: New unit test covering resolved
identity, anonymous identity, not-yet-resolved identity, and failed deferred
resolution
## Test plan
- [x] New unit test `PolarisEventMetadataFactoryTest` passes (4 cases)
<!--
๐ Describe what changes you're proposing, especially breaking or user-facing
changes.
๐ See https://github.com/apache/polaris/blob/main/CONTRIBUTING.md for more.
-->
## Checklist
- [ ] ๐ก๏ธ Don't disclose security issues! (contact [email protected])
- [ ] ๐ Clearly explained why the changes are needed, or linked related
issues: Fixes #
- [ ] ๐งช Added/updated tests with good coverage, or manually tested (and
explained how)
- [ ] ๐ก Added comments for complex logic
- [ ] ๐งพ Updated `CHANGELOG.md` (if needed)
- [ ] ๐ Updated documentation in `site/content/in-dev/unreleased` (if needed)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
